Vulnerability Intelligence Report
CVE-2021-20218
A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2
No Active Exploit Signals
CVSS Base Score
7.4
HIGH
EPSS Probability:1.31%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-22 ↗CWE-22
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| redhat | kubernetes-client | all |
| redhat | a-mq_online | all |
| redhat | build_of_quarkus | all |
| redhat | codeready_studio | 12.0 |
| redhat | descision_manager | 7.0 |
| redhat | integration_camel_k | all |
| redhat | jboss_fuse | 7.0.0 |
| redhat | openshift_container_platform | 3.11 |
| redhat | process_automation | 7.0 |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
1.312%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Red Hat, Inc. · Vendor · USA |
| Reserved | 2020-12-17T00:00:00 |
| Published | 2021-03-16T21:00:32 |
| Last Updated | 2024-08-03T17:30:07 |
Community Chatter & Buzz